Dashboards & Visualizations

Splunk alert configuration based on dynamic log error/exception patterns

saro0710
New Member

Hi,

We are using splunk for log managment and as well as alert configuration based on Exceptions/Errors threshold which works very well for static log contents.

But if a new exception or error is introduced due to a new release or patch, there is no way to find out the new pattern of errors/exceptions with splunk alerting system.

Is there any way that we can configure dynamic alerts based on dynamic nature of log pattern changes in terms of exceptions and erros with the help of REST API framework ?

Please let me know the detail

Thanks,
Saravanan

Tags (2)
0 Karma

Ayn
Legend

This sounds like something you could do with the anomalies operator. It applies to a sliding window of events for which it monitors a field you define, and then assign an "unexpectedness" score to each value of that field.

So if you have a windows containing 10000 events and 9000 of them have the value "foo", 999 have the value "obnoxious ozelot" and the 10000th event arrives with the value "preposterous panda", Splunk will assign a very high unexpectedness score to that since it's never been seen before in the sliding window of events. You could then use the unexpectedness in your alert conditions to trigger alerts on events that don't match any of the expected values.

More information on the anomalies command is available here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Anomalies

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...